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Abstract 

It is known that for any general access structure, a secret sharing scheme (SSS) can be con- 
structed from an (to, TO)-threshold scheme by using the so-called cumulative map or from a (t, m)- 
threshold SSS by a modified cumulative map. However, such constructed SSSs are not efficient 
generally. In this paper, we propose a new method to construct a SSS from a (i, TO)-threshold 
scheme for any given general access structure. In the proposed method, integer programming is 
used to distribute optimally the shares of (f, m)-threshold scheme to each participant of the general 
access structure. From the optimality, it can always attain lower coding rate than the cumulative 
maps except the cases that they give the optimal distribution. The same method is also applied to 
construct SSSs for incomplete access structures and/or ramp access structures. 

Key words: Secret sharing schemes, threshold schemes, general access structures, multiple as- 
signment map, cumulative map, ramp schemes, integer programming. 

1 Introduction 

A Secret Sharing Scheme [1, 2] (SSS) is a method to encrypt a secret information S into n pieces 
called shares Vi,V2, ■ ■ ■ ,Vn, each of which has no information of the secret S, but S can be decrypted 
by collecting several shares. For example, a {k, n)-threshold SSS means that any k out of n shares 
can decrypt the secret S although any — 1 or less shares do not leak out any information of S. The 
{k, n)-threshold access structure can be generalized to so-called general access structures which consist 
of the families of qualified sets and forbidden sets. A qualified set is the subset of shares that can 
decrypt the secret, but a forbidden set is the subset that does not leak out any information of S. 

Generally, the efficiency of a SSS is measured by the entropy of each share. It is known that for 
any access structures, the entropies of secret S and shares Vi, i = 1,2, ... ,n, must satisfy HiVi) > 
H{S) [3, 4, 5]. On the other hand, in the case of (/c, n)-threshold SSSs, the optimal SSSs attaining 
H{Vi) = H{S) can easily be constructed [1]. However, it is hard to derive efficient SSSs for arbitrarily 
given general access structures although several construction methods have been proposed. 
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For example, the monotone circuit construction [6] is a method to realize a SSS by combining 
several (m, m)-threshold SSSs. This method is simple but inefficient, and hence, it is extended to 
the decomposition construction [7], which uses several decomposed general SSSs. Although the de- 
composition construction can attain the optimal coding rates for some special access structures, it 
cannot construct an efficient SSS in the case that the decomposed SSSs cannot be realized efficiently. 
Note that a monotone circuit construction is based on qualified sets. Hence, as another extension of 
monotone circuit construction, a method is proposed to construct a SSS with general access structures 
based on qualified sets and (i, m)-threshold SSSs [8]. 

On the other hand, for any given general access structure, a SSS can be constructed from a {t, m)- 
threshold SSS by a multiple assignment map such that t or more shares of the (t, m)-threshold SSS are 
assigned to qualified sets but t — 1 or less shares are assigned to forbidden sets. The cumulative map 
is a simple realization of the multiple assignment map based on an (m, m)-threshold SSS [9, 10, 11], 
and from the simplicity, it is often used in visual secret sharing schemes for general access structures 
[12, 13]. However, it is known that the SSS constructed by the cumulative map is inefficient generally, 
especially in the case that the access structure is a (/c, n)-threshold SSS with k ^ n. Recently, a 
modified cumulative map based on a (t, m)-threshold SSS is proposed to overcome this defect [14]. 
But, the modified cumulative map is not always more efficient than the original cumulative map. 

In this paper, we propose a new construction method that can derive the optimal multiple assign- 
ment map by integer programming. The proposed construction method is simple and optimal in the 
sense of multiple assignment maps. Furthermore, it can also be applied to incomplete and/or ramp 
access structures. 

This paper is organized as follows. In Section 2, we give the definitions of SSSs and introduce the 
multiple assignment map. We also introduce the construction methods of the cumulative map and the 
modified cumulative map, and we point out their defects. To overcome such defects, we propose a new 
construction method of the optimal multiple assignment map by integer programming in Section 3. 
Finally, Sections 4 and 5 are devoted to present the applications of the proposed method to incomplete 
or ramp SSSs for general access structures, respectively. 

2 Preliminaries 
2.1 Definitions 

Throughout this paper, a set of shares and a family of share sets are represented by bold-face and 
script letters, respectively. For sets A and B, we denote a difference set by A — S, which is defined 
as A — B = Af\B where B means the complement of B. Furthermore, the cardinality of A is 
represented by |A|, and the Cartesian product of A and B is expressed by A x B. 

Let V = {Vi,V2, ■ ■ ■ ,Vn} be the set of shares, and let 2^ be the family of all subsets of V. 
We represent the family of qualified sets that can decrypt a secret information S and the family of 
forbidden sets that cannot gain any information of S by Ai and Ao, respectively. 

r = {Ai,Ao} is called an access structure. For instance, the access structure of (A;, n) -threshold 
SSSs can be represented as follows: 



Ai = {A G 2^ : A; < |A| < n}, 
Ao = {A G 2^ : < I A| < A; - 1}. 



(1) 
(2) 



In SSSs, it obviously holds that Ai D Aq = 0. If it also holds that U = 2^, the access structure 
is called complete. Note that any access structure must satisfy the following monotonicity. 



AeAi A' eAi for all A' d A (3) 
AeAo ^ A' G A for all A' C A (4) 

Therefore, we can define the family of minimal qualified sets and the family of maximal forbidden sets 
as follows: 



= {AeAi:A-{V}^ Ai for any V G A}, 
A^ = {Ae Aq: AU{V} ^ Ao for anyVeV- A}. 



(5) 
(6) 



We assume that the secret information S and each share Vi are random variables, which take values 
in finite fields F5 and Fy., respectively. Then, share set A = {V^^, l^j, . . . , I^„}(C V), which takes 

def 

values in Fa = Fy.^ x Fy.^ x • • • x Fy.^ , must satisfy the following conditions: 

H{S\A) = H{S) if A G Ao, (7) 
H{S\A) = a AeAi, (8) 

where H(S) is the entropy of 5* and H{S\A) is the conditional entropy of S for given A. 

Now, let us define the coding rate of a share Vi as pi '= H{Vi)/H{S), for i = 1,2, ... ,n. Since 
each Pi may be different in the case of general access structures, it is cumbersome to treat each pi 
independently. Hence, we consider only the following average coding rate p and worst coding rate p* . 

1 " 

1=1 

P* =^ ma? Pi- (10) 

l<i<n 

For a given access structure T = {Ai,Ao}, we call V eV a significant share if there exists a share 
set A G 2^ such that A U {V} G Ai but A G Ao- 

Remark 1 Note that a non-significant share plays no roll in the SSS, and hence, Pi = can always 
be attained for each non-significant share Vi in any access structure T. Furthermore, if there exists a 
non-significant share Vi with pi > 0, the average coding rate can be reduced by setting pi = without 
changing all the significant shares. Hence, we call a non-significant share a vacuous share. On the 
other hand, we have Pi > I for any significant share Vi because it must satisfy H{Vi) > H{S) [4, 5, 3]. 
In the following, we assume that every share is significant. □ 

If a SSS attains pi = I for all i, it is called ideal. It is known that in the case of {k, n)-threshold 

SSSs, the ideal SSS can easily be constructed for any k and n [1]. Since pi > 1, i = 1,2, ... ,n, must 
hold for any significant share Vi in any access structures, p = 1 or p* = 1 are the necessary and 
sufficient conditions for a SSS to be ideal [4]. 

2.2 Multiple Assignment Map 

Let r = {Ai,Ao} be a given general access structure with share set V = {Vi,V2, . . . ,Vn} and let 
W(^t^^) = {Wi^\w^^\ w4*^} be the share set of a {t, m)-threshold SSS. We now consider a map 



(fl' : {1,2, ... ,n} 2^(*''"), which assigns each participant a subset of the shares generated by the 
(t, m)-threshold scheme, and a map <I>r : 2^ 2^('''"', which is defined as $r(^) =^ UvjGA VtI^) for 
a share set A C V. Then, ipr is called a multiple assignment map for the access structure T if each 
share is determined by = (/'r(^) and ^r{A) satisfies the following conditions: 

|$r(A)|>t if AG A, (11) 
|$r(A)|<t-l ifAGAo, (12) 
MV) = W^t,m)- (13) 

To distinguish Wj^^ G from the shares Vi of F, we call wj*^ a primitive share. 



Since any (t, m)-threshold SSS can easily be constructed as an ideal SSS [1, 3], we assume in this 
paper that the {t, m)-threshold SSS with W(^t,m) = ^2*\ • • • ) Wm} is ideal. Then, the average 

and worst coding rates defined by (9) and (10) become 

-5 =^El'^r(i)|, (14) 



■ 1 

1=1 



p* = max \(pr{i)\, (15) 

l<i<n 

respectively, since it holds that pi = \(pY{i)\- 

In the case oi t = m, it is known that the multiple assignment map (p-p satisfying (11)-(13) can be 
realized for any access structures [9, 10, 11]. Suppose that the access structure T = {Ai,Ao} has 

A+ = {Fi,F2,...,F^}. (16) 

Note that m = \Aq\. Then, consider the map : {1, 2, . . . , n} 2^(-.-) defined by 

#(^)= U (17) 



where Fj G Aq and W(^m,m) = {W^^\W2^\ . . . , wil"^} is the set of primitive shares of an {m,m)- 
threshold SSS. The above multiple assignment map -^r is called the cumulative map. 

Example 2 Assume that n = 4 and access structure Fi is defined by 

= { ^2, v^], {Fi, F4}, {V2, M, {^3, M}> (18) 

At = {{Vi,V2},{VuV^},{V2,V^},{V^!}. (19) 
Then, m = |A^| = 4, and the cumulative map ipn is given from (17) as follows. 

Fi=Vr,(l) = {w^f }, (20) 

F2=V'ri(2) = {w^f }, (21) 

^3 = #,(3) = {w-i('\wf }, (22) 

F4 = Vr,(4) = {<\iy^\iyf }. (23) 

In this example, it holds that p = 9/4 and p* = 3. □ 



It is known that the next theorem holds for the cumulative map ipr- 

Theorem 3 ([15]) For any multiple assignment map cp^ : {1, 2, . . . ,n} 2^('''") with t = m, it must 
hold that |W^(m,m)l — l-^o"!) i-^-j ^ ^ \^o\- The equality holds if and only if ipr{i) is equal to the 
cumulative map V'r(^) defined by (17), where we assume that all t/r's obtained by permutations of 
Fj's in (16) are the same. □ 

Theorem 3 means that, in the case of t = m, the cumulative map Vr minimizes the number of 
primitive shares m. But, the minimization of m does not mean the realization of an efficient SSS 
generally because it does not minimize the average coding rate p and/or the worst coding rate p*. 

For instance, consider the case that F is a (k, n)-thrcshold access structure with k ^ n. If we 
construct shares Vi by the cumulative map -0 for this F, each Vi must consist of (^Zj) primitive shares 

of an ^(ji."^), (j^"^)^ -threshold SSS because of |^o^| = {jjli)- This means that p = p* = (^Zi)- But, 
if we use the {k, n)-threshold SSS itself, we have p = p* = 1 because each Vi consists of one primitive 
share. Hence, the cumulative map is quite inefficient in the case that F is a (fc, n)-threshold access 
structure. In order to overcome this defect, a modified cumulative map is proposed in [14] based on 
{t, m)-threshold SSSs. The modified cumulative map ■^p is constructed as follows. 

Construction 4 ([14]) For a given F = {^(J',^^} ^^'^ ^ positive integer g =^ min \A\, let Qq C Aq 

be the family defined by 

go = {GeA+: \G\ > g}. (24) 

When Go = {Gi, G2, . . . , G„} ^ 0, let = \Gj\ - g + 1 for j = l,2,...,u, and ij = E^^^ Ip. If 
Qo = 0, let It = 1 and £1 = 0. Then, consider a (5 + n + £M)-threshold SSS and the set of primitive 
shares W(^+^„,„+^„) = {wi'^^''\w^'^^-\ . . . , W^^^!"^}" Furthermore, let Uj,j = l,2,..., u, be the 
subset of primitive shares defined by 

C/i = if ^0 = 0, (25) 

t^.- = {<X'-i+i'<^U---'<t;"^} if ^0^0, (26) 
where ^0 = 0- Then, the modified cumulative map ■^p is defined by 



u < 



U ^A- (27) 

□ 



In the case where F is a {k, n)-threshold access structure, it holds that Qq = 9 and Ui = 0, 
and hence, it holds that V'r(*) ~ {^/'^^} for i = 1, 2, . . . , n and this scheme coincides with the ideal 
(fc, n) -threshold SSS [14]. Therefore, the modified cumulative map V'r is efficient if F is, or is near 
to, a {k, n)-threshold access structures. Furthermore, it is shown in [14] that if the access structure F 
satisfies 

\A-\ > i--9-m. + n + 2\go\ 

n-g+1 ^ ' 

then it holds that for the original cumulative map ip-p, 'l2viev \'^'ri^)\ — X^v^ev iV'r(^)l) which means 
that the average coding rate p of ip'-p is smaller than or equal to ipr- 

But, as shown in the following example, V'r always more efficient than ipi' if F does not 

satisfy (28). 



Example 5 Consider the access structure Fi given by (18) and (19) in Example 2, which does not 

def 

satisfy (28). Since we have g = 2 from (18), Qq becomes Qq = {{Vi, V2}, {Vi, 1^3}, {V25 ^3}} = 
{Gi,G2,G3}. Furthermore, since we have that li = I2 = I3 = 1 and £3 = 3, C/j's are determined 
as J7i = {W^}, U2 = {W^}, Us = {Wi^^} for W^^j) = {wi^\wP , . . . ,wi^^}. Hence, we can 
check that Fi does not satisfy (28) because of |v4o"| = 4, n = 4, 5 = 2, ^„ = 3, and \Go\ = 3. Finally, 
we have from (27) that 

(29) 
(30) 
(31) 
(32) 



Vi 


= vK(i) = 






V2 


= vK(2) = 






V3 


= V'^,(3) = 






V4 









}■ 



In this example, the coding rates are given by p = 5/2 and p* = 4, which are larger than the coding 
rates of Example 2, i.e., p = 9/4 and p* = 3. □ 

Note that (28) does not guarantee that the worst coding rate p* of -^p is smaller than ipr- Actually, 
the next example shows a case where ip'^ attains a smaller average coding rate but gives larger worst 
coding rate than t/r- 

Example 6 Consider the access structure F2 given by 



AT = {{Vi, V2, V3, V5}, {Vi, V2, F4}, {^1,^3, ^4}, {Vi, F4, n}, 

{^2, V3, F4}, {V2,V4, F5}, {V3,V4, V5}}, 
A^ = {{Vl, V2,V3}, {Vi,V2,V5}, {VuV3, F5}, {^2,1^3, V^}, 
{Vi, F4}, {V2, F4}, {V3,V4}, {F4, n}}. 



(33) 
(34) 



Then, the cumulative map is constructed as follows: 





= Vr,(l) = 








(35) 


V2 


= Vr,(2) = 








(36) 


V3 


= #2(3) = 


{lyf ,VFf 


,iyf 




(37) 




= #,(4) = 








(38) 


V5 


= Vr,(5) = 








(39) 



which attains that p = p* = 4. On the other hand, the modified cumulative map ■i/'p^ is given by 



Vl 


= ^^2(1) = 


{wP,wP}, 


(40) 


V2 


= ^K(2) = 


{wP,wP}, 


(41) 


V3 


= V'r2(3) = 




(42) 


V4 


= ^K(4) = 




(43) 


V5 


= ^^2(5) = 


{wP,wP}- 


(44) 



Observe that the rates of tp[r^ are given by p = 13/5, p* = 5. Hence, ip^^ gives smaUer p but larger p* 
than ■ ^ 

As shown in Examples 5 and 6, the modified cumulative map cannot always overcome the defects 
of the original cumulative maps. Hence, in the next section, we propose a construction method of 
multiple assignment maps that can attain the optimal average or worst case coding rates based on 
integer programming. 



3 Optimal Multiple Assignment Maps 



For a multiple assignment map '■ {!> 2, . . . , n} 
let Xp be the subset of W^^^^) defined by 



, a set A C V, and p G {0, 1, . . . , 2" - 1}, 



Xp — 


n Mi) 


n 


n Mi) 




i:b{p)i=l 




i:b{p)i=0 



(45) 



where b{p)i is the i-th least significant bit in the n-bit binary representation of p. For example, in the 
case of p = 5 and n = 4, it holds that 6(5)i = 6(5)3 = !> ^-nd (45) becomes X5 = ^^(4) H 95r(3) fl 
y?r(2) n (pr{l)- Figure 1 is the Venn diagram which shows the relation between Xp's and (^r(0's in 
the case of n = 3. Since cpr must satisfy (13), it must hold that HILi '/'r(i) = 0, which implies that 
Xq = 0. Hence, we consider only Xp for p = 1, 2, . . . , 2" — 1 in the following. 



def , 



Then, it is easy to check that Xp^s satisfy the following equations for an arbitrary n and N = 2 



x^ p n X p 



ifp^p' 
'Prii) = (J Xp 

p:6(p)i=l 

$r(A) = U Mi) = [j X, 

for some VjSA 

Letting Xp = \Xp\, the cardinality of $r(A.) is given by 

l^r(A)| = ^P' 

p:b(p)i = l 

for some ViSA 



(46) 
(47) 

(48) 



(49) 



from (46) and (48). 

Now, we describe how to design the optimal multiple assignment map (pr which attains the min- 
imum average coding rate. Note that, in order to design the multiple assignment map ipr for the 
set of primitive shares ,„), we have to determine only Xp, p = 1,2, ... ,N, and t, since m can be 
calculated as m = Ef=i^pfrom (13) and (49). 

Let y [t,xi,X2, . . . ,xn] be the {N + l)-dimensional parameter vector to minimize the average 
coding rate. Furthermore, for an integer i and a share set A, define an (iV-|- l)-dimensional row vector 



a{i; A) [£, l(A)i, 1(A)2, . . . , l(A)Ar] where 



1 if b{p)i = 1 for some Vi E A 
otherwise. 



(50) 




Figure 1: Relation between ipr{i)^s and X^s in the case of n = 3. 

Then, since (49) can be represented by inner product as |$r(-A)| = o,{0; A) ■ where superscript T 
means the transpose of vector y, the inequahties in the constraints (11) and (12) can be represented 
by a(0; A)-y'^ > t, and a(0; A)-y'^ <t — l, respectively. Therefore, these constraints can be expressed 
as 

a(-l;A)-y^>0 ifAe^^, (51) 
-a(-l;A)-y^-l >0 HAeA^, (52) 

respectively. Furthermore, denoting the Hamming weight in the binary representation of p by hp, it 
holds from (47) that 

n n N 

Xli'^r(«)| = XI Yl Xp = ^hpXp = h-y^, (53) 

j=l i=l p:6(p)i=l p=l 

where h = [ho, hi, ... , /ijv] G Hence, the average coding rate p in (14) is given by (1/n) h ■ y^ 

which we want to minimize. 

We note here that a(-; •) and h do not depend on the multiple assignment map cpr, and hence, 
summarizing (50)-(53), we can formulate the integer programming problem IPp(r) that minimizes 
the average coding rate p under the constraints of (11) and (12) as follows: 

iPp(r) 

minimize h • y^ 

subject to a(— 1; A) • > for A G A{ 
-a(-l; A) • y"^ > 1 for A G 



The optimal multiple assignment map i^r that attains the minimum average coding rate can be con- 
structed as follows. First, let j/ = [t,xi,X2, ■ ■ ■ , xn] be the minimizers of the integer programming prob- 
lem IPp(r), and we use the {i, m)-threshold SSS with primitive shares W^(t,^) = {wi^\w^*\ W^^} 
for secret S where m can be calculated from rh = X^^i Xp. Then, for each p, we can assign Xp different 
primitive shares of W^^^-j to Xp that satisfies \Xp\ = Xp and (46). Finally, the multiple assignment 
map (fr is obtained by (47). 

Next, we consider the integer programming problem IPp*(r) that minimizes the worst coding 
rate p*. Let M be the maximal number of assigned primitive shares among all Vi, i = 1,2, ... ,n. 
Then, it holds that |v^r(^)| ^ M for all i = l,2,...,n, and the minimization of M attains the 
optimal worst coding rate. Now, let z be the {N + 2)-dimensional parameter vector defined by 
z =^ [M, t, xi,X2, - ■ ■ ,xn]- Then, it holds that M = e-z^ where e is the (iV-|-2)-dimensional row vector 
defined by e =^ [1,0,0, ... ,0]. Furthermore, by defining b{£,£';A) =^ [£,£', l(A)i, 1(A)2, . . . , 1{A)n] 
where l{A)p is defined by (50), the number of primitive shares assigned to a share set A C V can 
be expressed as b(0, 0; A) ■ z^ . Hence, in the same way as IPp(r), the integer programming problem 
IPp* (r) that minimizes the worst coding rate p* can be formulated as follows: 

iPp*(r) 



minimize e • 

subject to 5(0, -1; A) • > for A € A~{ 
-6(0,-1; A) -z^ > 1 for A G A([ 
-6(-l,0;{y}) -z^ > for V 
z>0 

The multiple assignment map (p^ attaining the minimum p* can also be constructed from the 
obtained minimizer in the same way as the construction of (fr- 

Remark 7 Actually, in SSSs, we can assume without loss of generality that xn = 0, i.e., X^r = 
PliLi ^Tii) = because it is not necessary to consider the set of primitive shares commonly contained 
in every share. Hence, the vectors in integer programming problems IPp(r) and IPp*(r) can be 
reduced to AT-dimensional and {N + l)-dimensional vectors, respectively. However, xat = does not 
hold generally in the case of ramp SS schemes, which is described in Remark 20 in Section 5.2. □ 

Example 8 For the access structure Fi defined by (18) and (19) in Example 2, the integer program- 
ming problem IPp(ri) can be formulated as follows: 

iPp(ri) 

minimize xi -|- X2 + 2xs + X4 + 2x5 -|- 2xq + 8x7 + xs + 2xq + 2xio 

+3xii + 2xi2 + 3xi3 -I- 3xi4 

subject to —t + Xi + X2+X2 + X4 + X5 + XQ + Xj + .Tg 

+XiQ + Xii + Xi2 + Xis + Xi4 > 

-i -I- Xi + X3 + X5 + X7 + X8 + Xg + Xio + Xii + X12 + Xi3 + X14 > 

-i -I- X2 + X3 -I- X6 + X7 -I- X8 + Xg -I- Xio + Xn -|- X12 + X13 -|- X14 > 

-i -I- X4 -I- X5 -I- X6 + X7 -I- X8 + Xg -I- Xio + Xu + X12 + X13 -|- X14 > 

t — Xi - X2 - X3 — X5 — X6 - X7 - Xg — Xio - 3^11 - X13 - X14 > 1 

t — Xi — X3 — X4 — X5 — Xg — X7 — Xg — Xn — X12 — Xi3 — Xi4 > 1 

i — X2 — X3 — X4 — X5 — Xe — X7 — Xio — — Xi2 — Xi3 — Xi4 > 1 

i - X8 - Xg - Xio - Xii - X12 - Xi3 - X14 > 1 

Xp > 0,p = 1,2,...,14 



By solving the above IPp(ri), we obtain that the value of the objective function is 5, which is 
attained by the following minimizers: 



t = 3, xi 



X2 = X4 = 1, xs = 2, Xi = for i = 3, 5, 6, 7, 9, 10, ... , 14, 



(54) 



Hence, rh is given by m = Ylp=i — 5, and Xp's become 



{i^f)}, x, = {wP}, x, = {wP}, Xs = {wP,wP}, 



where W 



(3,5) 



, Wg^^}. Finally, from (47), (pri is constructed as 

Fi = ^r,(l) = {w-f }, 
V2 = ^rA^) = {wP] , 



(55) 

(56) 
(57) 

(58) 
(59) 



.(4) 



In this case, we have that p = 5/4 and p* = 2. The integer programming problem IPp* (Ti) derives the 
same solutions as (54), and hence, it holds that ipYi = ^^^^ example. Recall that the cumulative 

map attains the coding rates p = 9/4 and p* = 3, and the modified cumulative map ip'^^^ attains 
p = 5/2 and p* = 4. Hence, (^n can attain smaller coding rates compared with ■^n and ■^p^. □ 

Example 9 For the access structure r2 defined by (33) and (34) in Example 6, we can obtain the 
following multiple assignment map by solving the integer programming problem IPp(r2). 

(60) 
(61) 
(62) 

(63) 
(64) 

where W^^^ G ^(4,6)- Then, it holds that p = 6/5 and p* = 2. Furthermore, it holds that (^r2 = 
in this access structure. Recall again that the cumulative map ijjr^ attains the coding rates p = p* =4, 
and the modified cumulative map ■^p^ attains p = 13/5 and p* = 5. Hence, (^r2 is more efficient than 
ipr2 and ^p^. □ 

Since any access structure can be realized by the cumulative map (and the modified cumulative 
map), there exists at least one multiple assignment map for any access structure. Therefore, the next 
theorem holds obviously. 

Theorem 10 For any access structure F that satisfies monotonicity (3) and (4), the integer program- 
ming problems IPp(r) and IPp*(r) always have at least one feasible solution, and hence, there exists 
the optimal multiple assignment map. □ 





= ^r2(l) = 


{"f >} . 


V2 


= 0r,i2) = 




V3 


= ifr^iS) = 






= ^r2(4) = 




V5 


= <^r2(5) = 





}. 



We note that the integer programming problems are NP-hard, and hence, the proposed algorithms 
may take much time in solving for large n (= \V\). But, in the case that n is not large, the solution 
is obtained quickly. For instance, in the case of IPp(r3) in Example 11 with n = 6, it can be solved 
within 0.1 seconds by a notebook computer. 

Example 11 Consider the following access structure Fa: 

= {{Vi,Vs, Vi, V5}, {V,,V3, V5, Ve}, {Vi,V4, V5, Ve}, {Vs, F4, V5, Ve}, {Vi,V2, V3}, {Vi, V2, V^}, 
{Vi, V2, Ve}, {V2, Vs, V^}, {V2, V3, F5}, {V2, V3, Ve}, {V2, V4, V^}, {V2, V4, V^}, {V2, V^, Ve}}, 



(65) 

= {{Vi,V3, F4, Ve}, {Vi,V2, F4}, {Vi,Vs, V5}, {Vi,Vi, V5}, {^1,^5, Ve}, {V3, F4, ^5}, 

{^3, V5, V,}, {V4, V5, Ve}, {V2, Vs}, {V2, V5}, {V2, Ve}}. (66) 

Then, we obtain the following multiple assignment map by solving IPp (F3). 

Vi = 0rsa) = {wi'\w^'^], (67) 

V2 = ^r3(2) = {wi'\wt M'\wP} , (68) 

Vs = <prs{3) = {wP}, (69) 

V4 = 0rA^) = {wPM'^}, (70) 

^5 = m(5) = {w^f }, (71) 

y6 = ^r3(6) = {l^f }, (72) 

where w/^^ G ^^"(6,8) • attains that p = 2 and p* = 4. On the other hand, the cumulative map for 
the access structure F3 are given by 

= #3(1) = {Wt\wr\wt\wr\wi^\wil'^} , (73) 

V2 = #3(2) = {Wi''\wt\wt\wt\wl,''\wi''\wt'} , (74) 

Vs = ^r3(3) = {W^''\wt\wt\wt\wil'\wil'^} , (75) 

n = ^r3(4) = {Wt\wt\wr\w^''\wi^\wil'^} , (76) 

V. = ^r3(5) = , (77) 

Ve = ^r3(6) = {w^''\w^''\wt\wt'\wi''\wS'^} , (78) 
where W^^^^ G W 

(11,11)- VTs has p = 35/6 and p* = 7. Furthermore, the modified cumulative map 

for F3 requires (12, 15)-threshold SSS and has p = 5 and p* = 9. □ 



Next, we clarify what kind of access structure can be realized as an ideal SSS by the multiple 
assignment map. 

Theorem 12 For an access structure F, the SSS constructed by the optimal multiple assignment map 
is ideal, i.e., Pi = 1 for all i, if and only if Ai of F can be represented by 

Ai= \J {Aj^ X X • • • X Aj,} , (79) 

V{3l,J2. ■■■.«} 
C{l,2,...,rn,} 



where Hs a positive integer and {Ai, A2, . . . , Am} is a partition of V which satisfies 

m 

U = ^' (80) 

Aj^$ forj = l,2,...,m, (81) 
A,nA,v = ifjV/- (82) 

□ 

Proo/ of Theorem 12: If there exists a partition {Ai, A2, . . . , A^} satisfying (79)-(82) for the 
access structure F, the ideal SSS can be obtained by letting 

<fT{i)=wf liVieAj (83) 

for each i = 1, 2, . . . , n. Next, we show the necessity of (79)-(82). Suppose that a certain iprii) attains 
ft = 1 for all i. Then, define each Aj as 

A,- {{K^}) , 3 = 1,2,..., m, (84) 

for j = 1, 2, . . . , m where : 2^(*''") — > 2^ is the inverse map of $r(A) =^ I]j:y.eA <^r(0- Then, it 
is easy to see that A^'s satisfy (79), (80) and (81). Next, we prove that Aj's defined by (84) satisfy 
(82). Assume that there exist Aj and Aj/, j 7^ j', not satisfying (82). Then, there exists a share 
Vi ^ Aj n Ajt. This means that ipr{i) 5 {Wj^\Wj)^}, which contradicts pi = \<fr{i)\ = 1- Hence, 
{Ai, A2, . . . , Am} must be a partition of V satisfying (79)-(82). □ 

In the case of t = 2, it is known that an access structure F can be reahzcd by an ideal SSS if and only 
if F can be represented by a complete multipartite graph [16]. We note that this condition coincides 
with (79)-(82) in this case. Furthermore, in the case that \Aj\ = 1 for j = 1,2, ...,m, the access 
structure coincides with the {t, m)-threshold access structure. Hence, if F is the {k, n)-threshold access 
structure, the multiple assignment maps obtained from the integer programming problems IPp(F) and 
lPp*(F) obviously satisfy that |<pr(OI = Iv'M*)! = ^ ^• 

We note that any access structures not satisfying (79)-(82) must have p > 1 and p* > 2 if the 
multiple assignment map is used. But, an access structure not satisfying (79)-(82) might be realized 
as an ideal SSS if we use another construction method. For example, refer [7]. 

In this paper, we assume that every share is significant. But, if there exist vacuous shares in the 
access structure F, it is cumbersome to check whether each share is significant or vacuous. Prom 
Remark 1, the optimal multiple assignment map (^r attaining the minimum average coding rate must 
satisfy that |(^r(^)| = for any vacuous share Vi. On the other hand, it clearly holds that |95r(i)| > 1 
for every significant share Vi since ft > 1 holds for any significant share. Hence, by solving the integer 
programming problem IPp(F), we can also know whether a share is significant or vacuous. 

4 Multiple Assignment Maps for Incomplete Access Structures 

In the previous sections, we considered how to construct a SSS for a complete general access structure 
F = {Ai,Ao}. But in practice, it may be cumbersome to specify whether each subset of V is a 
qualified set or a forbidden set because the number of the subsets is 2". Hence, a method is proposed 
in [11] to construct a SSS for the case such that some subsets of V are not specified as qualified nor 
forbidden sets. 



Theorem 13 ([11]) Let F" = {^5,>1q} be an incomplete access structure, which has ,4* U .A^ 7^ 2^. 
Then, there exists a complete access structure F = {.4i,^o} such that 

A{ C ^1, (85) 
AI C ^0, (86) 

if and only if it holds that for any A G .4^ and B E Aq, 

A^B. (87) 

□ 

In case that (87) is satisfied, the SSS satisfying the incomplete access structure F" = {^j^,^q} 
can be realized by applying the cumulative map to the complete access structure F = {^i,^o}- 
In fact, for the access structure F" = {^^,^q}, a SSS is constructed in [11] by a cumulative map 
V'rti(0 = Uj-Vf^Fj{^i*^} fo'^ ^0''' ~ {Pi^P2, ■ ■ ■ ,Fm}- This construction corresponds to the case that 

A+ = and Ai = 2^ -Aq. (88) 

However, ip-^i is not efficient generally because ip-pt is a cumulative map, which is inefficient as 
described in Section 2.2. Furthermore, even if the cumulative map can attain the optimal coding rates 
for the access structure given by (88), the access structure may not be optimal among all the complete 
access structures F = {^1,^0} satisfying (85) and (86) for given F" = {^5,^q}. 

In our construction based on integer programming, the optimal multiple assignment map for the 
incomplete access structure F" = {^}^,^q^} can easily be obtained by applying IPp(F) or IPp*(F) 
directly to F". 

Example 14 Let us consider the following access structure F3 = {^|,^q}: 

A{ = {{Vi, V4, V5, Ve}, {Vi,V2, V^}, {Vi, V2, Ve}, {V2, Vs, ^e}, {V2, V4, V^}}, (89) 
AI = {{Vi,V2, V4, Ve}, {Vi, Vs, Fs}, {VuV^, Vq}, {V3, F4, ^^5}, {V4, ^5, Ve}, {V2, V5}}, (90) 

Note that Ai and Aq satisfy Ai C A^ and Aq C Aq for F3 = {^1,^0}) which is defined by (65) and 
(66) in Example 11. Then, by solving ^^(Fg), we obtain the following multiple assignment map. 



^ 3 




(91) 


V2 = (2) = 

^ 3 


{wt\wt'}, 


(92) 


F3 = <^r«(3) = 




(93) 


^ 3 




(94) 


^ 3 




(95) 


Ve = (^ptt (6) = 
^ 3 




(96) 



where W-^ ' G W(4 6), and it holds that p = 7/6 and p* = 2. If we apply the cumulative map to Fg, 

V'pU is constructed from the (6, 6)-threshold scheme, and it has p = 3 and p* = 5. □ 
^ 3 

Similarly to the complete SSS, vacuous shares Vi in F« = {^1,^1^} can be detected by checking 
|(^pj(i)| = for the solution of the IPp(F''). 



5 Ramp SSSs with General Access Structures 



The coding rate pi must satisfy pj > 1 for any significant share Vi in the case that the access structure 
consists of ^1 and .4o, i.e., every subset A C V is classified into either quahfied sets or forbidden 
sets. But, in the case of ramp access structures such that some subsets of V are allowed to have 
intermediate properties between the qualified and forbidden sets, it is possible to decrease the coding 
rate pi to less than 1. The SSSs having the ramp access structure are called ramp schemes [17, 18]. 
In this section, we treat the construction of ramp SSSs based on the multiple assignment maps. We 
consider only the minimum average coding rate in this section. But, for the minimum worst coding 
rate, integer programming can be formulated in a similar way. 

5.1 Preliminaries for Ramp Schemes 

First, let us review the definition of ramp SSSs. Suppose that L + 1 families Aj C 2^, j = 0, 1, . . . , L, 
satisfy the following. 

H{S\A) = ^^^H{S), for any A G Aj (97) 

Equation (97) implies that the secret S leaks out from a set A G Aj with the amount of {j /L)H{S). 
Especially, S can be decrypted completely from any A E Al , and any A E Aq leaks out no information 
of S. Note that, in the case of L = 1, the ramp SSS reduces to the SSS treated in Sections 2-4, and 
hence, the ramp SSS can be considered as an extension of the ordinal SSS. To distinguish the ordinal 
SSSs from ramp SSSs, the ordinal SSSs are called the perfect SSSs. We call = {Ao,Ai, . . .,Al} 
the access structure of the ramp SSS with L + 1 levels. Without loss of generality, we can assume that 
Uj=o ~ -^j ^ ■^j' ~ ^ j ^ fi although incomplete access structures with Uj=o -^i 7^ 

can be treated in the same way as in Section 4. 

For example, the access structure of {k, L, n)-threshold ramp SSS [18, 17] is defined as follows: 

Ao = {Ae2^ :0<\A\<k- L}, (98) 
Aj = {Ae2^ ■.\A\ = k-L + j}, for 1 < j < L - 1, (99) 
AL = {Ae2^ ■.k<\A\< n}. (100) 

In ramp SSSs, a significant share can also be defined in the same way as the perfect SSSs shown 
in Section 2.1. A share G V is called significant if there exists a share set A G 2^ such that 
AU{Vi} G Aj and A G Aj' with j > f. Then, a non-significant share V^/ satisfies that AU{V^'} G Aj for 
any share set A G Aj, j = 0, 1, . . . , L. Furthermore, if a non-significant share V^/ satisfies {Vi'} G Ao, 
Vi' plays no roll in the ramp SSS, and hence, we call Vii a vacuous share. However, there exists a ramp 
scheme such that Aq = and a non-significant share satisfy {Vi} G Aj for some j > 1. This case 
implies that HiVi') > H{S)/L, and H(Vi/\V) = for any V E V, i.e., a non-significant Vi' is included 
in every share. Therefore, we call such a non-significant share Vi' a common share. 

Remark 15 It is known that for any access structure with L+1 levels, the coding rate pi must 
satisfy pi > 1/L for any significant share Vi [19]. Especially, in the case of (/c, L, n)-threshold SSSs, 
the optimal ramp SSS attaining pi = 1/L for all i can easily be constructed [17, 18]. Any common 
share Vi must also satisfy that pi > 1/L. On the other hand, in the same way as Remark 1 for the 
perfect SSSs, each vacuous share Vi can be realized as pj = for any access structure. Furthermore, 



if there exists a vacuous share with pi > 0, the average coding rate can be reduced by setting pi = 
without changing all the significant and the common shares. □ 

Letting Aj Ae and Aj '= U^=i Ae, for j = 0, 1, . . . , L, the monotonicity in (3) and (4) are 

extended as follows: 

AeAj A' e Aj for all A' d A (101) 
AeAj A' e Aj for all A' c A (102) 

Therefore, the minimal and maximal families of the access structure, = {^q . . . ,Aj^} and 
= {^^, ^j'", . . . , Aj^}, respectively, can be defined as 

Aj = {AeAj:A- {V} ^ Aj for any V G A}, (103) 
A+ = {AeAj:AU {V} ^ Aj for any V e 2^ - A}. (104) 

Then, the following theorem holds. 

Theorem 16 ([19]) A ramp SSS with access structure = {Aq,Ai, . . . ,Al} can be constructed if 
and only if Aj (or Aj) satisfies the monotonicity (101) (or (102)) for all j = 1, 2, . . . , L. □ 

In Theorem 16, the necessity of the condition is obvious, and the sufficiency is established by the 
next construction. 

Construction 17 ([19]) Let S = . . . , ^W} be a secret, and let L^^) = {Aj,2^ - Aj}, 

j = 1, 2, . . . , L, be the perfect access structures determined from a given access structure F^. Since 
each r^-^^ is a perfect access structure satisfying the monotonicity (3) and (4), we can construct 
a SSS with r<J) for secret S^^l Letting {vl^\v^^^\ . . . ,vJl^^} be the shares for and T^), the 
share Vi = {V-^^\V-^'^\ . . . , V^^"^^} realizes the access structure F^. For F^, a ramp SSS can also be 
constructed from {2^ - Aj,Aj} instead of F^-') = {2^ - Aj,Aj}. 

□ 

Remark 18 Note that in Construction 17, we have pi > I for any access structure. For example, in 
the case that Construction 17 is applied to the {k, L, n)-threshold access structure, the constructed 



ramp SSS has pi = 1 although the (A;, L, n)-threshold SSS can be realized with pi = 1/L. Therefore, 

Construction 17 is not efficient generally. □ 

Example 19 Consider the following ramp access structure F^ for V = {Vi, V2, V3, V4}: 

A3 = {{Vi,V2,V3,V4}}, (105) 

A2 = {{Vi,V2,V3},{Vi,V3,V4}}, (106) 

^1 = {{Vi,V2,V4},{V2,V^,V^}}, (107) 

Ao = {A:0<\A\< 2}. (108) 



First, we derive the access structures T^^\ F^^\ and F^^^ based on (105)-(108), and it is easy to see 
that F<i> and F<3) become (3, 4)- and (4, 4)-thrcshold access structures, respectively. Hence, we have 
= wf) and V}^^ = W^^'^^ for i = 1,2,3,4 where {wj;^^}f^^ and {wj;'^^}j^^ are the share sets 
of (3,4)- and (4, 4)-threshold access structures for secrets 5^^^ and S^^\ respectively. Furthermore, 
a perfect SSS with the access structure F^^^ for a secret can be realized by such that 



y^<2> ^ ^^(3)^ y_{2) ^ ^^(3)^ y{2) ^ ^^(3)^ y{2) ^ ^^(3) ^j^^^^ {W^'^^^jf^i is the share sets of 
(3, 3)-threshold SSS for 

According to Construction 17, we can obtain the shares such that Vi = {W^^\w[^^\wi'^'^}, 

W2^^)}, ^3 = {W^^\W^^^\W^'^^}, Vi = {Wi^\ ^}. Since each share consists of three primitive 

shares for three secrets S^^\ 3^"^^ S^^\ the constructed ramp SSS has p = p* = 1. □ 

The construction of ramp SSSs for general access structures are treated in [20]. But, since the 
construction in [20] is based on monotone span programming, it is much complicated compared with 
the multiple assignment map. 

5.2 Optimal Multiple Assignment Maps for Ramp SSSs 

First, let = {Wi'^\W2'^\---,Wm^^} be the set of primitive shares for the {t,L,m)- 

threshold ramp SSS with the coding rate pi = 1/L. Then, defining y and a{i;A) in the same way 
as the perfect SSSs in Section 3, the optimal ramp SSS by the multiple assignment map for a general 
access structure can be obtained by solving the following integer programming problem: 

minimize h ■ y^ 

subject to a(-l; A) • > for A e A]^ 

-a{-l; A) ■ y'^ = j for A £ Aj U Aj for 1 < j < L - 1 (★) 

-a(-l; A)-y'^ > L for A€ A^ 

y> 

Remark 20 From the monotonicity defined in (101) and (102), it is sufficient to consider only A G 
Aj' U Aj instead of all A G Aj on the marked line (★) in IP^ (r^) • Note that the same primitive 
shares may be distributed to all shares since there may exist common shares in ramp SSSs. Hence, we 
may have xjv 7^ in the ramp SSSs although we can always assume that x^v = in the perfect SSSs. 
□ 

Prom Remark 15, significant or common shares Vi must satisfy that |97r(^)| > 1 for any multiple 
assignment map ipr- On the other hand, |(^r(^')l = must hold for vacuous shares Vi' for the optimal 
multiple assignment map (pr attaining the minimal average coding rate. Hence, it suffices to consider 
only significant shares and common shares in the ramp SSSs. 

Example 21 If the access structures Vf in Example 19 is applied to the integer programming problem 
IP^ (r^) , the following multiple assignment map is obtained 

Fi = ^r«(l) = {vFP\w^p)}, (109) 
V2 = ^r-i^) = {W^'''\wi'''^} , (110) 

F3 = <?r«(3) = {w-P\w^f''^}, (111) 
V, = ^ru{A) = {wi'''\wi'''^}, (112) 

where w/^'^^ G ^^^(7,3,7). attains that p = p* = 2/3. □ 



Note that the coding rates less than 1 cannot be achieved by Construction 17. Furthermore, 
our construction is much simpler compared with the method in [20]. But, unfortunately, the integer 
programming problem may not have any feasible solutions in the case of ramp SSSs. 

Example 22 The following access structure cannot be constructed by any multiple assignment 
map since the corresponding integer programming problem has no feasible solution. 

= {{Vi, V2, Fa, F4}, {Vu ^2, F4, n}, {V2,V^, F4, ^5}}, (113) 
.43 = {{VuV2, F3, F5}, {^1,^3, ^4, n}, {Vi,V2, Fa}, {VuV2, F4}, {Fi, F3, F4}, 

{Fi,F3,y5},{F2,y3,M}> (114) 

A2 = {{VuV2, F5}, {Fi, F4, F5}, {F2, F3, F5}, {F2, F4, F5}, {F3, F4, F5}, {Fi, F3}, {Fi, F5}}, (115) 
Ai = {{Fi,F2},{F2,F3},{F3,F4}}, (116) 
^0 = {{Fi,F4},{F2,F5},{F3,F5}}, (117) 



□ 



In this case, we can modify the definition of the ramp SSS given by (97) as follows. 



H{S\A) = 0, for all A e Al, (118) 

L 

H{S\A) = H{S), for aU A G Aq. (120) 



H{S\A) > —^H{S), for all AeAj, 1 < j < L - 1, (119) 



In order to implement (118)-(120) in the integer programming, it suffices to replace the marked line 
(-k) in IP^ (P^) by ~ct(~l;^/) • ^ j- Letting IP^^ {^^) be the modified integer programming 
problem, the next theorem holds. 

Theorem 23 The integer programming problem IP^^ {^^) always has a feasible solution for any 
access structure P^. □ 

Proof of Theorem 23: Let V be a multiset in 2^, some elements of which may be the same. Then, for 
V and A C V, we define A/"(V, A) as follows. 

N{V, A) = \{A' •.A(ZA']\, (121) 

where all A' G V arc treated as diff'erent sets even if some of them are the same. Now we construct a 
multiset U for P^ = {Ao, Ai, . . . ,Al} by the next construction. 

Construction 24 

(1) Let W := and j := 1. 

(2) For each A G A'l_j satisfying N{U, A) < j, we add A into U, {j - N{U, A)) times. 

(3) Let j := j + 1. 

(4) If j < L, go to (2). In case of j = L, go to (5). 

(5) Outputs. □ 



From the monotonicity of Aj in (101), the family U can always be constructed. Then, letting 
U = {Fi, F2, . . . , Fm}, we can define a map tp : {1,2, . . . ,n} ^ 2^("^-^-"^) by 



(122) 



where wj^'''"^ G W^(m,L,m)- Note that in the case of L = 1, (122) coincides with the cumulative map 
irthermore, for any set G U, we can check from (122) that 

' (123) 



in (17). Furthermore, for any set F^ G U, we can check from (122) that 

wt'^W U 



holds for all i' satisfying Fi C Fp. 

Now, assume that Fi £ A'j. Then, from Construction 24, there exist a family of j subsets 
{Fi^,Fe2,...,FeA Q U satisfying F^ C for I' G {li,l2, . . . Hence, it holds from (123) that 



y^{rn,L) ^ jj^^^^^^ fQj. ^/ g {ii,£2, . . . ,£j}. This means that we can verify that [jj^.y.^p^ ip{j) 
m — j, and Vi = satisfies (118)-(120). Therefore, IP^^ (F^) always has at least one feasible 



< 



solution. 



□ 



Note that as shown in the following example. Construction 24 gives inefficient assignments of the 
primitive shares, generally. 

Example 25 Assume that the access structure Ff in (113)-(117) satisfies the conditions (118)-(120). 
First, we apply Construction 24 to the access structure T^. Then, we obtain the following multiset 



U^R = {{^1, V2, V3, V5}, {Vi,V3, V4, V^, {Vi,V2, V4}, {Vi,V2, V5}, {Vi,V^, V5}, {V2, V3, V5}, 
{V2, F3, V^}, {V2, V^, V5}, {V2, Vi, F5}, {V^, Vi, V^), {^1, F4}}. 

Hence, we can obtain Vi = i = 1, 2, . . . , 5, as follows: 



(124) 



Vi 


= m = 


1^(11,4) 




V2 


= m = 




^(11,4)^^(11,4) 


V3 


= m = 


1^(11,4) 


^(11,4)^^(11,4) 


Va 


= V.(4) = 


1^(11,4) 


^(11,4)^^(11,4) 


v^ 


= V;(5) = 


r^(n,4) 


^(11,4)^^(11,4) 



Ty(ll,4)l 



(125) 

,W^t'''"\, (126) 
^^ii,4)^^ii,4)^^^n,4)|^ (127) 

} , (128) 
} , (129) 

where Wi G ^(11,4,11). In this case, we have p = 21/20 and p* = 3/2 since it holds that H{W^^^'^^) = 
H{S)/A for each i. 

On the other hand, we can construct the following optimal multiple assignment map (^pij by solving 



the integer programming problem IP^ (Fg ). 





1 ^(8,4)^ ^(8,4) 1^ 


(130) 


F2 = ^r«(2) = 




(131) 


^3 = <^r«(3) = 

o 


j^(8,4)^^(8,4)|^ 


(132) 






(133) 


V5 = '^'M^) = 






(134) 



where W-^ ' ' G 4 9), and it holds that p = 1/2 and p* = 3/4, which are more efficient than the rates 
of Construction 24. Note that (125)-(129) and (130)-(134) do not satisfy (97) but satisfy (118)-(120). 
For instance, in (130)-(134), it holds for {^1,^5} G ^2 that H{S\{Vi,V5}) = H{S) > H{S)/2. 

Finally, we compare Construction 17 with Construction 24 for the access structure F^. If we 
use the cumulative map to realize each perfect SSS with the access structure j = 1,2,3,4, in 
Construction 17, we obtain p = 9/5 and p* = 2. Hence, Construction 17 is more inefficient than 
Construction 24 in this case. □ 



6 Conclusion 

We proposed a method to construct SSSs for any given general access structures based on (t, m)- 
threshold SSSs and integer programming. The proposed method can attain the optimal average 
and/or worst coding rates in the sense of multiple assignment maps. Hence, the proposed method can 
attain smaller coding rates compared with the cumulative maps and the modified cumulative maps. 
Furthermore, the proposed method can be applied to incomplete and/or ramp access structures in 
addition to complete and perfect access structures. 
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